Data leakage prevention method and device

Abstract

The present disclosure provides a data leakage prevention method and device, which relates to the computer field, and in particular to the data security field. The specific implementation scheme is: in response to receiving incoming data, the data is included in the detection queue; the data in the detection queue is detected using preset detection rules to obtain the sensitivity level and sensitivity type of the data; the sensitivity level and sensitivity type of the data are recorded in the database; in response to detecting the outbound operation of the data, the sensitivity level and sensitivity type of the data are obtained from the database; the data is processed according to the sensitivity level, sensitivity type and preset outbound rules of the data. This implementation method can detect data quickly and imperceptibly, and can improve the user experience while preventing data leakage.

Description

Technical Field

[0001] The present disclosure relates to the computer field, in particular to the data security field, and specifically to a data leakage prevention method and device. Background Art

[0002] Data leakage prevention (DLP) is a strategy that uses certain technical means to prevent an enterprise's designated data or information assets from flowing out of the enterprise in a form that violates security policies.

[0003] In order to prevent data leakage, existing data leakage prevention systems usually use serial detection or parallel detection methods to detect data when performing various data transmission operations (copying to a USB flash drive, sending via WeChat, sending via email, etc.). Serial detection is to release the data or block it with an error after the data detection is completed. Parallel detection is to detect the data while sending it out. When there are many rules or large files, the serial detection method will take a long time to detect, resulting in jams, which will lead to a very poor user experience. The parallel detection method has a short detection time and the user will not feel the jams, but because the data is sent out before the detection is completed, it cannot prevent data leakage. Summary of the invention

[0004] The present disclosure provides a data leakage prevention method, apparatus, device, storage medium and computer program product.

[0005] According to a first aspect of the present disclosure, a data leakage prevention method is provided, comprising: in response to receiving incoming data, placing the data in a detection queue; using preset detection rules to detect the data in the detection queue to obtain a sensitivity level and a sensitivity type of the data; recording the sensitivity level and the sensitivity type of the data in a database; in response to detecting an outbound operation of the data, obtaining the sensitivity level and the sensitivity type of the data from the database; and processing the data according to the sensitivity level, the sensitivity type and the preset outbound rules of the data.

[0006] According to a second aspect of the present disclosure, there is provided a data leakage prevention device, comprising: a receiving unit, configured to, in response to receiving incoming data, place the data in a detection queue; a detection unit, configured to detect the data in the detection queue using preset detection rules to obtain a sensitivity level and a sensitivity type of the data; a recording unit, configured to record the sensitivity level and the sensitivity type of the data in a database; a query unit, configured to, in response to detecting an outbound operation of the data, obtain the sensitivity level and the sensitivity type of the data from the database; and a control unit, configured to process the data according to the sensitivity level, the sensitivity type and preset outbound rules of the data.

[0007] According to a third aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the methods described in the first aspect.

[0008] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods according to the first aspect.

[0009] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program implements any one of the methods according to the first aspect when executed by a processor.

[0010] The data leakage prevention method and device provided by the embodiments of the present disclosure detects data when it flows in and records the sensitivity level and sensitivity type of the data. When the data is sent out, it is controlled according to the sensitivity level and sensitivity type of the data, which can not only prevent data leakage, but also reduce the sending delay and improve the user experience.

[0011] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0013] Figure 1 is an exemplary system architecture diagram in which an embodiment of the present disclosure may be applied;

[0014] Figure 2 is a flow chart of an embodiment of a data leakage prevention method according to the present disclosure;

[0015] Figure 3 is a flow chart of another embodiment of the data leakage prevention method according to the present disclosure;

[0016] Figure 4 is a schematic diagram of an application scenario of the data leakage prevention method according to the present disclosure;

[0017] Figure 5 is a structural schematic diagram of an embodiment of a data leakage prevention device according to the present disclosure;

[0018] Figure 6It is a structural diagram of a computer system of an electronic device suitable for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0020] Figure 1 An exemplary system architecture 100 is shown to which an embodiment of the data leakage prevention method or data leakage prevention device of the present disclosure can be applied.

[0021] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0022] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0023] Terminal devices 101, 102, 103 can be hardware or software. When terminal devices 101, 102, 103 are hardware, they can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, Moving Picture Experts Group Audio Layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, Moving Picture Experts Group Audio Layer 4) players, laptop computers and desktop computers, etc. When terminal devices 101, 102, 103 are software, they can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here.

[0024] The server 105 may be a server that provides various services, such as a background server that provides support for data interaction between the terminal devices 101, 102, and 103, such as an instant messaging server, a mail server, etc. The background server may analyze and process the received data and forward it to the corresponding terminal device. For example, when the terminal device 101 sends an email, the mail server sends it to the terminal device 102 according to the recipient address.

[0025] The server 105 can also provide detection rules, outbound rules, etc. for the terminal devices 101 , 102 , 103 to download.

[0026] It should be noted that the server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or it can be implemented as a single server. When the server is software, it can be implemented as multiple software or software modules (for example, multiple software or software modules used to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here. The server can also be a server of a distributed system, or a server combined with a blockchain. The server can also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0027] It should be noted that the data leakage prevention method provided in the embodiments of the present disclosure is generally executed by the terminal devices 101 , 102 , 103 , and accordingly, the data leakage prevention device is generally disposed in the terminal devices 101 , 102 , 103 .

[0028] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0029] Continue to refer Figure 2 , shows a process 200 of an embodiment of a data leakage prevention method according to the present disclosure. The data leakage prevention method comprises the following steps:

[0030] Step 201, in response to receiving incoming data, the data is put into a detection queue.

[0031] In this embodiment, the execution subject of the data leakage prevention method (for example Figure 1 The terminal device shown in the figure can receive the incoming data from the server or other terminal devices through a wired connection or a wireless connection, for example, by downloading through a browser, copying a USB flash drive to a terminal, downloading data through other applications, etc. The incoming data is included in the detection queue, which is equivalent to backing up the data in the detection queue.

[0032] Optionally, if the data is a layout document, such as PDF, etc., it can be converted into a streaming document, such as Word, etc. This makes detection easier.

[0033] Step 202: Use preset detection rules to detect the data in the detection queue to obtain the sensitivity level and sensitivity type of the data.

[0034] In this embodiment, the detection operation can be performed concurrently with other operations on the data, and will not affect other operations of the user on the data, such as copying, cutting, compressing, etc.

[0035] Detection rules refer to the corresponding sensitivity level and sensitivity type obtained when certain detection conditions are met. Detection conditions include but are not limited to keywords, regular matching, data identifiers, unstructured fingerprint libraries, structured fingerprint libraries, image fingerprint libraries, weighted dictionary libraries, attachment names, attachment sizes, attachment types, file encryption levels, protocols, abnormal behaviors, interfaces, and interface parameters. Common detection rules in the prior art can be used, so they will not be described in detail.

[0036] The sensitivity type can be set according to confidentiality requirements, for example, insensitive, outflow address sensitive, user identity sensitive, data size sensitive, etc. The sensitivity level can be divided into multiple levels, and different levels are handled in different ways. For example, sensitive data of level 1 is blocked, a pop-up window is displayed for sensitive data of level 2, and sensitive data of level 3 is released.

[0037] For example, if the data includes "@", the sensitive type is outflow address sensitive and the sensitivity level is level three.

[0038] Step 203, recording the sensitivity level and sensitivity type of the data into the database.

[0039] In this embodiment, the detection result of step 202 is stored in a database. The type of database is not limited here, and it can be any form of database. The index of the data in the database can be the storage address of the file where the data is located in the terminal device (for example, D:\test\data.xlsx). For example, the data is an Excel table, the sensitive type is outflow address sensitive, and the sensitivity level is level three. The storage address of the Excel table and "outflow address sensitive" and "level three" are stored in the database.

[0040] Step 204, in response to detecting an outbound operation of data, obtaining a sensitivity level and a sensitivity type of the data from a database.

[0041] In this embodiment, the outbound operation refers to the operation of sending data outside the local area, for example, sending via WeChat, uploading via FTP, sending via email, etc. The sensitivity level and sensitivity type of the data can be queried from the database according to the address of the data. For example, the Excel table in step 203 is sent via email, and its sensitivity level and sensitivity type are searched in the database according to the storage address of the Excel table.

[0042] Optionally, if the sensitivity level and sensitivity type of the data cannot be queried, the data is tested according to the detection rules to obtain the sensitivity level and sensitivity type, and then recorded in the database.

[0043] Step 205, processing the data according to the sensitivity level, sensitivity type and preset outbound rules of the data.

[0044] In this embodiment, the outbound rule can be a combination of sensitivity level, sensitivity type, and processing means (including blocking, pop-up window reminder, release, etc.). For example, the first-level sensitive data with sensitive outflow address is blocked and cannot be sent out. At the same time as the blocking, the reason will be prompted, such as "the data cannot be sent to xx company".

[0045] The method provided by the above embodiment of the present disclosure can quickly obtain the test results when the data is sent out. When using serial detection, there is no need to pass the detection of preset rules one by one, which affects the user experience. There is no need to use parallel detection to optimize the user experience, which may cause data leakage.

[0046] In some optional implementations of the present embodiment, the sensitivity level and sensitivity type of the data are recorded in a database, including: if the size of the data exceeds a predetermined threshold, features are extracted from the data; the features, sensitivity level and sensitivity type of the data are recorded in a database; and obtaining the sensitivity level and sensitivity type of the data from the database includes: querying the database for the sensitivity level and sensitivity type corresponding to the features. If the data is too large, for example, exceeding 1M, features can be extracted using a hash method, such as MD5. The features, sensitivity level and sensitivity type are then recorded in the database. Features can be used as indexes in the database. When a user sends data out, if the data is too large, the sensitivity level and sensitivity type corresponding to the feature are searched in the database. This saves database space and allows for quick and accurate search of the sensitivity level and sensitivity type of data.

[0047] In some optional implementations of this embodiment, the data is processed according to the sensitivity level, sensitive type and preset outbound rules of the data, including: if the sensitive type is sensitive to the outbound address, the security level of the outbound address of the data is detected; the data is processed according to the sensitivity level, sensitive type, security level and preset outbound rules of the data. The outbound address can be a mailbox, other application APP, instant messaging user, etc. The security level refers to the sensitivity level and sensitive type of the data that the outbound address can receive. The security level of the outbound address can be detected according to the preset identity recognition rules. The identity recognition rules are detection rules configured for the sender and receiver of the data, wherein the identity information includes but is not limited to the sender's mailbox, IP address and / or the receiver's mailbox, IP address, domain name and other detection conditions. For example, an excel sheet is sent to a WeChat group. It is necessary to conduct a security assessment on the WeChat group, and a whitelist can be pre-set. Only WeChat groups within the whitelist can send data of specified sensitive types and sensitivity levels. The sender's identity can also be detected to detect whether the sender has the authority to send files in groups. Through the identity recognition rules, the sending of data can be further restricted, and different identity recognition rules can be set for different application scenarios. While improving data security, permissions are opened in a targeted manner, thereby improving detection efficiency.

[0048] Further references Figure 3 , which shows a process 300 of another embodiment of a data leakage prevention method. The process 300 of the data leakage prevention method includes the following steps:

[0049] Step 301, in response to receiving incoming data, the data is put into a detection queue.

[0050] Step 302: Use preset detection rules to detect the data in the detection queue to obtain the sensitivity level and sensitivity type of the data.

[0051] Step 303: Record the sensitivity level and sensitivity type of the data into the database.

[0052] Steps 301-303 are substantially the same as steps 201-203, and thus are not described in detail herein.

[0053] Step 304: in response to detecting that the data is flowing locally, updating the file information where the data is located in the database in real time.

[0054] In this embodiment, local transfer refers to file moving, copying, pasting, modifying, compressing, file format conversion, etc. No matter how the data is operated, the sensitivity level and sensitivity type of the data in the database remain unchanged, and only the data address is updated. For example, if the original file name is test.doc, after the file is converted to pdf, even if it is renamed run.pdf or compressed to hello.rar, its sensitivity level and sensitivity type in the database remain unchanged.

[0055] In some optional implementations of this embodiment, the data flow in the computer includes at least one of the following: file movement, copying, pasting, modification, compression, and file format conversion. No matter how the data changes, the address in the database can be tracked and updated.

[0056] Step 305: In response to detecting an outbound operation of data, obtaining a sensitivity level and a sensitivity type of the data from a database.

[0057] Step 306: Process the data according to the sensitivity level, sensitivity type and preset outbound rules of the data.

[0058] Steps 305-306 are substantially the same as steps 204-205, and thus will not be described in detail.

[0059] from Figure 3 It can be seen that Figure 2 Compared with the corresponding embodiment, the process 300 of the data leakage prevention method in this embodiment embodies the steps of tracking the data flow. Therefore, the solution described in this embodiment can update the database in real time according to the flow of data, so as to ensure that no matter how the data flows, the sensitivity level and sensitivity type of the data can be queried. Therefore, it is unnecessary to repeatedly detect the data, reducing the data processing cost and delay.

[0060] Continue to see Figure 4 , Figure 4 FIG. 1 is a schematic diagram of an application scenario of the data leakage prevention method according to this embodiment. Figure 4 In the application scenario, the terminal perception capability is first started and the data detection function is enabled. The terminal loads the policy from the server, including detection rules and outbound rules. When the terminal detects data inflow, the incoming data is sent to the queue for detection, and the data detection results (sensitive type and sensitivity level) can be obtained. The data detection results are recorded in the database. When the terminal detects data flow, the storage address of the data in the database is updated. When the terminal detects data outflow, the detection results of the outflow data are queried from the database, and then processed according to the outbound rules, such as blocking, pop-up reminder, and release.

[0061] Further references Figure 5As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a data leakage prevention device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0062] like Figure 5 As shown, the data leakage prevention device 500 of this embodiment includes: a receiving unit 501, a detection unit 502, a recording unit 503, a query unit 504 and a control unit 505. The receiving unit 501 is configured to, in response to receiving the incoming data, put the data into a detection queue; the detection unit 502 is configured to detect the data in the detection queue using a preset detection rule to obtain the sensitivity level and sensitivity type of the data; the recording unit 503 is configured to record the sensitivity level and sensitivity type of the data into a database; the query unit 504 is configured to, in response to detecting the outbound operation of the data, obtain the sensitivity level and sensitivity type of the data from the database; the control unit 505 is configured to process the data according to the sensitivity level, sensitivity type and preset outbound rule of the data.

[0063] In this embodiment, the specific processing of the receiving unit 501, the detecting unit 502, the recording unit 503, the query unit 504 and the control unit 505 of the data leakage prevention device 500 can refer to Figure 2 Corresponding to step 201, step 202, step 203, step 204 and step 205 in the embodiment.

[0064] In some optional implementations of this embodiment, the device 500 further includes an updating unit (not shown in the drawings), which is configured to: in response to detecting that the data is circulating locally, update the file information of the data in the database in real time.

[0065] In some optional implementations of this embodiment, the recording unit 503 is further configured to: extract features from the data if the size of the data exceeds a predetermined threshold; record the features, sensitivity level and sensitivity type of the data in a database; and obtain the sensitivity level and sensitivity type of the data from the database, including: extract features from the data if the size of the data exceeds a predetermined threshold; and query the database for the sensitivity level and sensitivity type corresponding to the features.

[0066] In some optional implementations of this embodiment, the control unit 505 is further configured to: if the sensitive type is outflow address sensitive, detect the security level of the outflow address of the data; and process the data according to the sensitivity level, sensitive type, security level and preset outbound rules of the data.

[0067] In some optional implementations of this embodiment, data flow within the computer includes at least one of the following: file movement, copying, pasting, modification, compression, and file format conversion.

[0068] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0069] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0070] An electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in process 200 or 300.

[0071] A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method described in process 200 or 300.

[0072] A computer program product includes a computer program, and when the computer program is executed by a processor, the method described in flow 200 or 300 is implemented.

[0073] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0074] like Figure 6As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0075] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0076] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as data leakage prevention methods. For example, in some embodiments, the data leakage prevention method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the data leakage prevention method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the data leakage prevention method in any other appropriate manner (e.g., by means of firmware).

[0077] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0078] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0079] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0080] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0081] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0082] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0083] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0084] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A data leakage prevention method, comprising: In response to receiving the incoming data, placing the data into a detection queue; Using a preset detection rule to detect the data in the detection queue, and obtaining a sensitivity level and a sensitivity type of the data, wherein the sensitivity type is set according to confidentiality requirements, including: insensitive, outflow address sensitive, user identity sensitive, and data size sensitive; If the size of the data exceeds a predetermined threshold, features are extracted from the data by hashing, and the features, sensitivity level and sensitivity type of the data are recorded in a database, wherein the features include MD5; In response to detecting an outgoing operation of the data, obtaining a sensitivity level and a sensitivity type of the data from the database; If the sensitive type is that the outflow address is sensitive, the security level of the outflow address of the data is detected; the data is processed according to the sensitivity level, sensitive type, security level and preset outbound rules of the data, wherein the outflow address includes mailboxes, other application APPs, and instant messaging users, and the security level is the sensitivity level and sensitive type of data that the outflow address can receive. The security level is detected according to preset identity recognition rules, and the identity recognition rules are detection rules configured for the sender and receiver of the data.

2. The method according to claim 1, wherein: The method further comprises: In response to detecting that the data is circulating locally, the file information where the data is located in the database is updated in real time.

3. The method according to claim 1, wherein obtaining the sensitivity level and sensitivity type of the data from the database comprises: The feature queries the database for a sensitivity level and a sensitivity type corresponding to the feature.

4. The method according to claim 2, wherein: The data flow in the computer includes at least one of the following: file movement, copying, pasting, modification, compression, and file format conversion.

5. A data leakage prevention device, comprising: A receiving unit, configured to, in response to receiving the incoming data, put the data into a detection queue; A detection unit is configured to detect the data in the detection queue using a preset detection rule to obtain a sensitivity level and a sensitivity type of the data, wherein the sensitivity type is set according to confidentiality requirements, including: insensitive, outflow address sensitive, user identity sensitive, and data size sensitive; a recording unit configured to extract features from the data by hashing if the size of the data exceeds a predetermined threshold, and record the features, sensitivity level and sensitivity type of the data in a database, wherein the features include MD5; a query unit, configured to obtain a sensitivity level and a sensitivity type of the data from the database in response to detecting an outgoing operation of the data; The control unit is configured to detect the security level of the outflow address of the data if the sensitive type is that the outflow address is sensitive; and process the data according to the sensitivity level, sensitive type, security level and preset outbound rules of the data, wherein the outflow address includes mailboxes, other application APPs, and instant messaging users, and the security level is the sensitivity level and sensitive type of data that the outflow address can receive, and the security level is detected according to preset identity recognition rules, and the identity recognition rules are detection rules configured for the sender and receiver of the data.

6. The device according to claim 5, wherein: The apparatus further comprises an updating unit configured to: In response to detecting that the data is circulating locally, the file information where the data is located in the database is updated in real time.

7. The device according to claim 5, wherein: The obtaining the sensitivity level and sensitivity type of the data from the database includes: The database is queried for the sensitivity level and sensitivity type corresponding to the feature.

8. The device according to claim 6, wherein: The data flow in the computer includes at least one of the following: file movement, copying, pasting, modification, compression, and file format conversion.

9. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-4.

11. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 4.

Images